Support Apache Airflow 3.x (clears remaining dev-scope security alerts)

[jiayuasu]

Context

Dependabot has been proposing to bump apache-airflow 2.11.x → 3.x (#60) and apache-airflow-providers-fab → the 3.x line (#61) to resolve advisories that are only patched in Airflow 3.x. These are not safe auto-merges: Airflow 3 has breaking API changes, and #60 silently relaxes the supported-version cap from <3 to <4. Supporting Airflow 3 is a deliberate effort, not a dependency bump.

Current state

After #62 (dev-lock refresh), 65 of the original 86 Dependabot alerts are cleared. The remaining ~21 are all in the dev-only apache-airflow test tree — the published provider only depends on wherobots-python-dbapi + pydantic, so none of these ship to users:

• ~15 apache-airflow CVEs patched only in 3.x
• flask, flask-appbuilder, pytest transitives that Airflow 2.x pins below their patched versions

Scope

• Port provider code to the Airflow 3.x API (assess breaking changes)
• Decide supported range (drop 2.x, or support 2.x + 3.x via a test matrix)
• Update the apache-airflow dev constraint accordingly
• Move apache-airflow-providers-fab / related providers to their 3.x lines
• CI test matrix for the supported Airflow versions
• Regenerate uv.lock

Supersedes auto-PRs #60 (airflow 3.2.2) and #61 (providers-fab 3.6.4).

[jiayuasu]

This is another request as well: #51